JWT Invalid Signature
The JWT signature does not match the expected signature for the given header and payload.
Root Cause
The token was tampered with, signed with a different secret/key, or the wrong algorithm was used for verification.
How to Fix
Verify you are using the same secret/key for signing and verification. Check that the algorithm matches. Never trust a JWT without verifying its signature.
Quick Summary
JWT signature invalid, the token was tampered with or signed with a different key. Always verify JWTs server-side with the correct secret/key. Never trust unverified JWTs.
Key Takeaways
- The token was modified after signing, or signed with a different key
- Always verify the signature server-side before trusting any claims
- Use asymmetric keys (RS256) for tokens shared across services
- Never use alg: none, it disables signature verification
When to use it
- Token tampered with in transit
- Wrong secret used for verification
- Token from a different environment (dev secret used in prod)
Common Mistakes
- Not verifying the algorithm, always specify the expected algorithm in verify()
- Using the same secret across environments, use different secrets per environment
JsonWebTokenError JWT Invalid Signature, Frequently Asked
What is the difference between HS256 and RS256?
HS256 uses a shared secret (symmetric). RS256 uses a public/private key pair (asymmetric), better for multi-service architectures where multiple services verify tokens.
Still having issues?
Check your network logs or use our developer tools to inspect headers, decode tokens, or validate your requests.